Change DNS without taking your website or email offline
Copy every record to the new DNS host before switching, check the email records twice, remove DNSSEC at the registrar first, then change the nameservers and keep the old DNS in place until the change has spread.
Applies to: Cloudflare
On this page
The safe order for moving DNS, or changing records your website or email depend on, is: copy every record to the new DNS host first, check the email records twice, turn off DNSSEC at the registrar and wait, then change the nameservers, and keep the old DNS host running until the change has spread. Done in that order, visitors and email carry on as normal throughout. For domains coming to Oogle, we do the Cloudflare part and guide you through the rest.
Why DNS changes cause outages
Most DNS outages come from one of four things:
- A record that existed at the old DNS host wasn't copied, often for email or a third-party service.
- DNSSEC was still on when the nameservers changed, so the domain stopped resolving.
- The old DNS host was shut down before every network had moved over.
- A typo in a nameserver or record value.
Each is avoidable with the checklist below.
Moving DNS to Cloudflare: the checklist
1. Gather every record
- List every service that uses your domain: website, email, newsletter tools, booking or shop platforms, Microsoft or Google verification, video or phone systems.
- Export a zone file from your current DNS host if it offers one, or take screenshots of every record.
- Send it to us in a Website Support ticket.
When we add your domain, Cloudflare scans your existing DNS and copies what it finds, but the scan can miss records. We review the bare domain, www, MX, SPF, DKIM and DMARC by hand and compare against your list. If you run your own Cloudflare account, Cloudflare can also import a standard BIND zone file (up to 256 KiB) from DNS Records → Import and Export.
2. Protect email
- Confirm your MX records match your email provider's setup page.
- Confirm there's exactly one SPF record and it lists every sending service.
- Confirm each DKIM record and the DMARC record are present.
- Make sure any mail hostname is DNS only, not proxied.
See Email DNS records.
3. Handle DNSSEC
If DNSSEC is on at your registrar, remove the DS record there and wait for it to expire, often 24–48 hours, before changing nameservers. See DNSSEC basics.
4. Change the nameservers
Replace every nameserver at your registrar with the two Cloudflare nameservers we sent you for this domain. See How to change your domain's nameservers.
5. Keep the old DNS for a while
Leave the old DNS host and its records untouched for a few days. Most networks move within a few hours, and providers quote up to 24–48 hours. Cancel the old DNS service only once the change is confirmed.
Changing an important record (DNS already on Cloudflare)
For big changes to an existing setup, such as moving to a new email provider or pointing the website at a new platform:
- Tell us in a ticket what's changing and when, ideally a day or more ahead.
- For DNS-only records, we can lower the TTL ahead of time so the switch spreads faster. Proxied records already update within about 5 minutes.
- Agree a time to switch, outside your busiest hours.
- Keep the old service running until the change has spread (for email, until no more mail reaches the old mailboxes).
- Check the result, then ask us to restore the normal TTL.
You'll know it worked when
The new nameservers or records show in lookups from more than one resolver, your website loads, and test emails in both directions arrive. To check:
dig ns example.com @1.1.1.1
dig mx example.com @8.8.8.8 +shortReplace example.com with your domain. The first should show only the two Cloudflare nameservers; the second your email provider's mail servers. Without a command line, use Google Public DNS and choose NS or MX after selecting Resolve.
Troubleshooting
- Email stopped after the switch. A mail record is missing or a mail hostname is proxied. Reply on your ticket straight away.
- A third-party service stopped working. Its record wasn't on your list. Send us the service's setup page.
- The domain stopped resolving. Almost always a leftover DNSSEC record. Remove it at the registrar.
- Still pending at Cloudflare after a day. Check the nameservers saved correctly and there's no registrar lock. See Troubleshoot a domain that isn't working.
Next steps
- Connect an existing domain to Oogle hosting
- How long DNS changes take
Frequently asked questions
Will there be any downtime?
Not if every record is copied first and both old and new DNS give the same answers. During the switch some visitors use the old DNS and some the new, so both must be correct.
Why keep the old DNS host for a few days?
Some networks keep asking the old nameservers until their copies expire. If you cancel the old DNS straight away, those visitors may briefly get no answer.
Can I give you a zone file?
Yes. If your old provider can export a zone file (a text file of all records), attach it to your ticket. Cloudflare can import a standard BIND zone file up to 256 KiB.